#include <yara/extend.h>
#include <jansson.h>
#include <stdio.h>
#include <yara/mem.h>
#include <yara/fuzzy.h>
#include<string.h>
#include<stdlib.h>
#include <openssl/md5.h>
#ifdef _WIN32
#include <windows.h>
#pragma comment(lib, "ws2_32.lib")
#else
#include <netinet/in.h>
#include <arpa/inet.h>
#endif
#include <time.h>
#include <sys/stat.h>
#include "threading.h"

#define host "182.254.243.223"
#define port 80

char *packet = NULL;
char *packet_content_tmp = NULL;
char *send_len = NULL;
char *file_upload_time = NULL;
char ** dest = NULL;
char *file_path_pre = NULL;
char *buf = NULL;
char *to_ = NULL;
char *to_1 = NULL;
char *to_2 = NULL;
char *to_3 = NULL;
char *to_4 = NULL;
char * chang_file_time = NULL;
char *change_file_path_ = NULL;
char *tmp_filename_ = NULL;
char * chang_file_name = NULL;
char *tmp_content = NULL;
char * send_content = NULL;
char * packet_head_ = NULL;
return_url *p2 = NULL;
return_url *r_head = NULL;

void digest_to_ascii_(
    unsigned char* digest,
    char* digest_ascii,
    size_t digest_length)
{
  for (int i = 0; i < digest_length; i++)
      sprintf(digest_ascii + (i * 2), "%02x", digest[i]);

  digest_ascii[digest_length * 2] = '\0';
}

unsigned char digest[16] = { 0 };

char digest_ascii[16 * 2 + 1] = { 0 };

char *md5(char *buf)
{
    MD5_CTX md5_context;
   
    MD5_Init(&md5_context);
    MD5_Update(&md5_context, buf, strlen(buf));
    MD5_Final(digest, &md5_context);
    digest_to_ascii_(digest, digest_ascii, 16);
    return digest_ascii;
}

void *allocate_one_dimension(int a)
{
	return yr_calloc(a, sizeof(char));
}

char  *allocate_one_dimension_s(int a)
{
    char *tmp = (char *)malloc(1024);
    memset(tmp,0,1024);
    return tmp;
}


char  **allocate_two_dimension(int a, int b)
{
	char ** dst = (char **)yr_calloc(a, sizeof(char *));
    if (dst == NULL)
        return NULL;
	for (int i = 0; i < a; i++)
	{
		dst[i] = (char *)yr_calloc(b, sizeof(char));
        if (dst[i] == NULL)
            return NULL;
	}
	return dst;
}

void free_two_dimension(char** ptr,int a)
{
	for (int i = 0; i< a; i++)
	{
		yr_free(ptr[i]);
	}
	yr_free(ptr);
}
char *get_open_file_stream(char *filepath_)
{
    char *buf = NULL;
    FILE  *f;
    f = fopen(filepath_, "r");
    if (f!= NULL)
    {
        fseek(f, 0, 2);
        int len = ftell(f);
        buf = (char*)allocate_one_dimension(len + 1);
        if (buf != NULL)
        {
            rewind(f);
            fread(buf, sizeof(char), len, f);
            fclose(f);
            return buf;
        }
        else
        {
            return NULL;
        } 
    }
    else
    {
        printf("file can not be found");
        return NULL;
    }
}


int get_open_file_length(char *filepath_)
{
    char *buf = NULL;
    FILE  *f;
    f = fopen(filepath_, "r");
    if (f != NULL)
    {
        fseek(f, 0, 2);
        int len = ftell(f);
        fclose(f);
        return len;
    }
    else
    {
        return 0; 
    }
}

//find webroot path from default configure

#ifdef _WIN32

void get_webroot_path_reg(char *target, char **s, int *count)
{
    int a = strlen(target);
    int start = 0;
    int end = 0;
    for (int i = 0; i < a; i++)
    {
        if (target[i] == 'p'&&target[i + 1] == 'h'&&target[i + 2] == 'y')
        {
            start = i;
        }
        if (target[i] == '<'&&target[i + 1] == '/'&&target[i + 2] == 'a'&&target[i + 3] == 'p'&&target[i + 4] == 'p'&&target[i + 5] == 'l'&&target[i + 6] == 'i'&&target[i + 7] == 'c'&&target[i + 8] == 'a'&&target[i + 9] == 't'&&target[i + 10] == 'i'&&target[i + 11] == 'o'&&target[i + 12] == 'n'&&target[i + 13] == '>')
        {
            end = i;
            int c = end - start;
            for (int i = 0; i < c - 35; i++)
            {
                (*s)[i] = target[start + 14 + i];
            }
            (*s)[c - 35] = '\0';
            s++;
            (*count)++;
        }
    }
}
#else
void get_webroot_path_reg(char *target, char **s, int *count)
{
    int a = strlen(target);
    int start = 0;
    int end = 0;
    for (int i = 0; i < a; i++)
    {
        if (target[i] == 'D'&&target[i + 1] == 'o'&&target[i + 2] == 'c')
        {
            start = i;
        }
        if (target[i] == '\n'&&target[i + 1] == '\n'&&target[i + 2] == '\t'&&target[i + 3] == '#'&&target[i + 4] == ' '&&target[i + 5] == 'A')
        {
            end = i;
            int c = end - start;
            for (int i = 0; i < c - 13; i++)
            {
                (*s)[i] = target[start + 13 + i];
            }
            (*s)[c - 13] = '\0';
            s++;
            (*count)++;
        }
    }
}

#endif

#ifdef _WIN32
void  get_webroot_path(char **s)
{
    char *buf_webroot = NULL;
    int count = 0;
    if ((buf_webroot = get_open_file_stream("C:\\Windows\\SysNative\\inetsrv\\config\\applicationHost.config")) != NULL)
    {
        get_webroot_path_reg(buf_webroot, s, &count);
    }
    else
    {
        printf("the web path of iis server has not been configured ");
        exit(1);
    }
}
#else
void  get_webroot_path(char **s)
{
    char *buf_webroot = NULL;
    int count = 0;
    if ((buf_webroot = get_open_file_stream("//etc//apache2//sites-available//000-default.conf")) != NULL)
    {
        get_webroot_path_reg(buf_webroot, s, &count);
    }
    else
    {
        printf("the web path  has not been configured ");
        exit(1);
    }
}
#endif



void  sub_string(char* src, int pos, int length, char *dst)
{
    if (src != NULL&&pos >= 0 && length >= 0 && dst != NULL)
    {
        int i;
        for (i = 0; i < length; i++)
        {
            dst[i] = *(src + pos++);
        }
        dst[length] = '\0';
    }
    else
    {
        dst = NULL;
    }
}

char *str_replace(char *src, char *search, char *replace)
{
    if (src != NULL&&search != NULL&replace != NULL)
    {
        int src_length = strlen(src);
        char *dst = (char *)yr_calloc(src_length, sizeof(char));
        if (dst == NULL)
            return NULL;
        int a = strlen(src) - strlen(search) + strlen(replace);
        if (a >= src_length)
        {
            dst = (char *)yr_realloc(dst, sizeof(char)*(a + 1));
            if (dst == NULL)
                return NULL;
        }
        char *position = strstr(src, search);
        int d = strlen(search);
        char *s = (char*)yr_calloc(1024, sizeof(char));
        if (s == NULL)
        {
            yr_free(dst);
            return NULL;
        }
        if (position == NULL)
        {
            yr_free(dst);
            yr_free(s);
            return NULL;
        }
        int e = strlen(src) - strlen(position);
        if (e >= 1024)
        {
            s = (char*)yr_realloc(s, sizeof(char)*(e + 1));
            if (s == NULL)
            {
                yr_free(dst);
                return NULL;
            }
        }
        sub_string(src, 0, e, s);
        if (s != NULL)
        {
            strcat(dst, s);
            strcat(dst, replace);
            strcat(dst, position + d);
            dst[a] = '\0';
            yr_free(s);
            return dst;
        }
        else
        {
            return NULL;
        }
    }
    else
    {
        return NULL;
    }
}



char *str_replace_bin(char *src, char *search, char *replace,int bin_count)
{
    int src_length = strlen(src);
    char *dst = (char *)yr_calloc(src_length, sizeof(char));
    if (dst == NULL)
        return NULL;
    int a = strlen(src) - strlen(search) + bin_count;
    if (a >= src_length)
    {
        dst = (char *)yr_realloc(dst, sizeof(char)*(a + 1));
        if (dst == NULL)
            return NULL;
    }
    char *position = strstr(src, search);
    if (position == NULL)
    {
        yr_free(dst);
        return NULL;
    }
    int d = strlen(search);
    char *s = (char*)yr_calloc(1024, sizeof(char));
    if (s == NULL)
    {
        yr_free(dst);
        return NULL;
    }
    int e = strlen(src) - strlen(position);
    if (e >= 1024)
    {
        s = (char*)yr_realloc(s, sizeof(char)*(e + 1));
        if (s == NULL)
        {
            yr_free(dst);
            return NULL;
        }
    }
    sub_string(src, 0, e, s);
    if (s != NULL)
    {
        strcat(dst, s);
        strcat(dst, replace);
        strcat(dst, position + d);
        dst[a] = '\0';
        yr_free(s);
        return dst;
    }
    else
    {
        return NULL;
    }
}


int  longest_word_length(char *src, int length,int threshold)
{
    int i, j;
    for (i = j = 0; i < length;)
    {
        while (i < length && (src[i] == ' ' || src[i] == '\r' || src[i] == '\n'))
            i++;
        j = i;
        while (i < length && (src[i] != ' ' &&src[i] != '\r'&&src[i] != '\n'))
            i++;
        if (j < i)
        {
            if (length-- <= 0)
                break;
            int b = i - j;
            if (b>threshold)
            {
                return  b;
            }
        }
    }
    return 0;
}


char * delete_00(char *a, int b)
{
    char *dst = (char*)allocate_one_dimension(b+1);
    if (dst == NULL)
    {
        return NULL;
    }
    int c = 0;
    char *tmp = dst;
    for (int i = 0; i < b; i++)
    {
        if (*a != '\0'||*a!=0x20)
        {
            memcpy(dst++,a,1);
            c++;
        }
        a++;
    }
    tmp[c] = '\0';
    return tmp;
}

void  split_yr_common(char *src,char delimit, char** dest, int* pCount, int length,int length_of_dest)
{
    int a = strlen(src);
    int i, j;
    int maxsplit = length;
    for (i = j = 0; i < a;){
        while (i < a && (src[i] ==delimit))
            i++;
        j = i;
        while (i < a && (src[i] != delimit))
            i++;
        if (j < i)
        {
            if (maxsplit-- <= 0)
                break;
            if ((*pCount) >= length_of_dest)
                break;
            char* sd = (char *)yr_calloc(i - j + 1, sizeof(char));
            if (sd==NULL)
            {
                return;
            }
            sub_string(src, j, i - j, sd);
            int c;
            for (c = 0; c < i - j; c++)
            {
                if ((i - j)>=4096)
                {
                    (*dest) = (char *)yr_realloc((*dest), (i - j + 1)* sizeof(char));
                    if ((*dest) == NULL)
                    {
                        yr_free(sd);
                        return;
                    }
                }
                (*dest)[c] = sd[c];
            }
            (*dest)[c] = '\0';
            dest++;
            (*pCount)++;
            yr_free(sd);
        }
    }
}


void  split_yr_common_in_main(char *src, char *delimit, char** dest, int* pCount, int length)
{
    int a = strlen(src);
    int i, j;
    int maxsplit = length;
    for (i = j = 0; i < a;){
        while (i < a && (src[i] == delimit[0] || src[i] == delimit[1]))
            i++;
        j = i;
        while (i < a && (src[i] != delimit[0] && src[i] != delimit[1]))
            i++;
        if (j < i)
        {
            if (maxsplit-- <= 0)
                break;
            char* sd = (char *)malloc(i - j + 1);
            if (sd == NULL)
            {
                return;
            }
            sub_string(src, j, i - j, sd);
            int c;
            for (c = 0; c < i - j; c++)
            {
                if ((i - j) >= 4096)
                {
                    (*dest) = (char *)realloc((*dest), (i - j + 1)* sizeof(char));
                    if ((*dest) == NULL)
                    {
                        free(sd);
                        return;
                    }
                }
                (*dest)[c] = sd[c];
            }
            (*dest)[c] = '\0';
            dest++;
            (*pCount)++;
            free(sd);
        }
    }
}


void  split_yr_common_in_main_(char *src, char delimit, char** dest, int* pCount, int length)
{
    int a = strlen(src);
    int i, j;
    int maxsplit = length;
    for (i = j = 0; i < a;){
        while (i < a && (src[i] == delimit))
            i++;
        j = i;
        while (i < a && (src[i] != delimit))
            i++;
        if (j < i)
        {
            if (maxsplit-- <= 0)
                break;
            char* sd = (char *)malloc(i - j + 1);
            if (sd == NULL)
            {
                return;
            }
            sub_string(src, j, i - j, sd);
            int c;
            for (c = 0; c < i - j; c++)
            {
                if ((i - j) >= 4096)
                {
                    (*dest) = (char *)realloc((*dest), (i - j + 1)* sizeof(char));
                    if ((*dest) == NULL)
                    {
                        free(sd);
                        return;
                    }
                }
                (*dest)[c] = sd[c];
            }
            (*dest)[c] = '\0';
            dest++;
            (*pCount)++;
            free(sd);
        }
    }
}
void string_ratio(char *s, char *target, float *ratio, unsigned long long data_len)
{
    int b = 0;
    if (target[0] == '\0')
    {
        b = 1;
    }
    else
    {
        b = strlen(target);
    }
	
	int count = 0;
    for (int i = 0; i < data_len; i++)
	{
		s++;
		for (int j = 0; j < b; j++)
		{
			if (((data_len--)- b) >= 0)
			{
				if (s[j] == target[j])
				{
					count = count + b;
				}
			}
		}
	}
    *ratio = (float)count / (float)data_len;
}

#ifdef _WIN32
void socket_def(SOCKET *sock,char *host_t,int port_t)
{
    WSADATA wsaData;
    struct sockaddr_in saddr;
    if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0)
    {
        printf("error");
    }
    saddr.sin_family = AF_INET;
    saddr.sin_port = htons(port_t);
    saddr.sin_addr.s_addr = inet_addr(host_t);
    *sock = socket(AF_INET, SOCK_STREAM, 0);
    if (*sock == INVALID_SOCKET)
    {
        printf("socket initialize failed: %d/n", WSAGetLastError());
    }
    if (connect(*sock, (struct sockaddr *)&saddr, sizeof(saddr)) == INVALID_SOCKET)
    {
        printf("connect failed: %d/n", WSAGetLastError());
    }
}
#else
void socket_def(int *sock,char *host_t,int port_t)
{
    struct sockaddr_in saddr;

    saddr.sin_family = AF_INET;
    saddr.sin_port = htons(port_t);
    saddr.sin_addr.s_addr = inet_addr(host_t);
    *sock = socket(AF_INET, SOCK_STREAM, 0);

    if (connect(*sock, (struct sockaddr *)&saddr, sizeof(saddr)) < 0)
    {
        printf("connect() Failed:");
    }
}

#endif

int _count_string(char *data, char *key)
{
    int count = 0;
    int klen = strlen(key);
    char *pos_start = data, *pos_end;
    while (NULL != (pos_end = strstr(pos_start, key))) {
        pos_start = pos_end + klen;
        count++;
    }
    return count;
}

int count_bin(char *data, char key,int count)
{ 
    int count_num_char = 0;
    for (int i = 0; i < count; i++)
    {
        if (data[i] == key)
        {
            count_num_char++;
        }
    }
    if (key == 13)
        return count_num_char / 2;
    return count_num_char;
}


char *malloc_replace(char *data, char *rep, char *to, int free_data)
{
    int rep_len = strlen(rep);
    int to_len = strlen(to);
    int counts = _count_string(data, rep);
    int m = strlen(data) + counts * (to_len - rep_len);
    char *new_buf = (char *)malloc(m + 1);
    if (NULL == new_buf) {
        free(data);
        return NULL;
    }
    memset(new_buf, 0, m + 1);
    char *pos_start = data, *pos_end, *pbuf = new_buf;
    int copy_len;
    while (NULL != (pos_end = strstr(pos_start, rep))) {
        copy_len = pos_end - pos_start;
        strncpy(pbuf, pos_start, copy_len);
        pbuf += copy_len;
        strcpy(pbuf, to);
        pbuf += to_len;
        pos_start = pos_end + rep_len;
    }
    strcpy(pbuf, pos_start);
    if (free_data)
        free(data);
    return new_buf;
}

void normal_replace(char *data, char *rep, char *to)
{
    char *new_buf = malloc_replace(data, rep, to, 0);
    if (NULL != new_buf) {
        strcpy(data, new_buf);
        free(new_buf);
    }
}

char * get_file_create_time(char *data)
{
    struct stat file_create_time_buf;
    stat(data, &file_create_time_buf);
    struct tm *t = localtime(&file_create_time_buf.st_ctime);
    if (t != NULL)
    {
        char *file_create_time = (char*)allocate_one_dimension(65);
        if (file_create_time != NULL)
        {
            sprintf(file_create_time, "%04d-%02d-%02d %02d:%02d:%02d",
                t->tm_year + 1900, t->tm_mon + 1, t->tm_mday,
                t->tm_hour, t->tm_min, t->tm_sec);
            return file_create_time;
        }
        else
        {
            return NULL;
        }
    }
    else
    {
        return NULL;
    }
}

char *get_time_now()
{
    time_t timep=time(NULL);
    struct tm *t = localtime(&timep);
    char *time_now = (char*)malloc(65);
    if (time_now == NULL)
        return NULL;
    sprintf(time_now, "%04d%02d%02d%02d%02d%02d",
        t->tm_year + 1900, t->tm_mon + 1, t->tm_mday,
        t->tm_hour, t->tm_min, t->tm_sec);
    return time_now;

}


file * filter(file * head)
{
    file * temp;
    temp = head;
    int count = 0;
    int total_size = 0;
    while (temp != NULL)
    {
        total_size += temp->filesize;
        count++;
        temp = temp->next;
    }

    if (total_size >= 5242880)
    {
        head->used = 1;
        return head;
    }
    else if (count >= 5)
    {
        head->used = 1;
        return head;
    }
    else if (get_over())
    {
        return head;
    }
    else
    {
        return NULL;
    }
}


file * group(file * head, time_t start_time, int timeout)
{
    file *tmp = head;
    int total_size = 0;
    int count_num = 0;
    file *head_tmp =NULL;
    file *tmp_2 = NULL;
    while (tmp != NULL)
    {
        file *tmp_t = (file *)yr_calloc(1,sizeof(file));
        if (tmp_t == NULL)
            return NULL;
        tmp_t->next = NULL;
        memcpy(tmp_t, tmp, sizeof(file));
        tmp_t->filebuf = get_open_file_stream(tmp_t->filename);
        if (tmp_t->filebuf != NULL)
        {
            tmp_t->filesize = get_open_file_length(tmp_t->filename);
            total_size = total_size + tmp_t->filesize;
            if (head_tmp == NULL)
            {
                head_tmp = tmp_t;
            }
            else
            {
                tmp_2->next = tmp_t;
            }
            tmp_2 = tmp_t;
            count_num++;

            if (total_size > 5242880)
            {
                tmp_2->next = NULL;
                return head_tmp;
            }
            else if (count_num > 5)
            {
                tmp_2->next = NULL;
                return head_tmp;
            }
            tmp = tmp->next;
        }
        else
        {
            yr_free(tmp_t);
            tmp = tmp->next;
            return NULL;
        }
    }
    if (count_num <= 5)
    {
        tmp_2->next = NULL;
        return head_tmp;
    }
}

void free_memory_sock_when_alloc_fail()
{
    if (packet != NULL)
    {
        yr_free(packet);
    }
    if (packet_content_tmp != NULL)
    {
        yr_free(packet_content_tmp);
    }
    if (send_len != NULL)
    {
        yr_free(send_len);
    }

    if (packet_head_ != NULL)
    {
        yr_free(packet_head_);
    }
    void free_memory_sock();
}

void free_memory_sock()
{
    if (file_upload_time != NULL)
    {
        yr_free(file_upload_time);
    }
    if (dest != NULL)
    {
        free_two_dimension(dest, 100);
    }
    if (file_path_pre != NULL)
    {
        yr_free(file_path_pre);
    }
    if (buf != NULL)
    {
        yr_free(buf);
    }
    if (to_ != NULL)
    {
        yr_free(to_);
    }
    if (to_1 != NULL)
    {
        yr_free(to_1);
    }
    if (to_2 != NULL)
    {
        yr_free(to_2);
    }
    if (to_3 != NULL)
    {
        yr_free(to_3);
    }
    if (to_4 != NULL)
    {
        yr_free(to_4);
    }
    if (chang_file_time != NULL)
    {
        yr_free(chang_file_time);
    }
    if (change_file_path_ != NULL)
    {
        yr_free(change_file_path_);
    }
    if (tmp_filename_ != NULL)
    {
        yr_free(tmp_filename_);
    }
    if (chang_file_name != NULL)
    {
        yr_free(chang_file_name);
    }
    if (tmp_content != NULL)
    {
        yr_free(tmp_content);
    }
    if (send_content != NULL)
    {
        yr_free(send_content);
    }
}
int  send_to_server(file *head)
{
    return_url* return_url_each = (return_url *)yr_calloc(1, sizeof(return_url));
    if (return_url_each == NULL)
        return 0;
    return_url_each->next = NULL;
    
    file*after_sock = head;
 
#ifdef _WIN32

    SOCKET sock;
    socket_def(&sock, host, port);
#else
    int sock;
    socket_def(&sock, host, port);
#endif
    char *packet_head = "POST /ShellDaddy/api/upload HTTP/1.1\r\nHost: 182.254.243.223:80\r\nContent-Length: ZZZ\r\nCache-Control: max-age=0\r\nOrigin: http://182.254.243.223:80\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36\r\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryCzP8OxYaOPN4gFyV\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\nReferer: http://182.254.243.223:80/ShellDaddy/api/upload\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: zh-CN,zh;q=0.8\r\nConnection: close\r\n\r\n";
    int send_length_tmp = 0;
    int count_tmp_file = 0;
    char *search_content_length_replace = "ZZZ";
    packet = (char *)allocate_one_dimension(409600);
    if (packet == NULL)
    {
        return 0;
    }
    packet_content_tmp = (char *)allocate_one_dimension(409600);
    if (packet_content_tmp == NULL)
    {
        free_memory_sock_when_alloc_fail();
        return 0;
    }
 
    send_len = (char *)allocate_one_dimension(10);
    if (send_len == NULL)
    {
        free_memory_sock_when_alloc_fail();
        return 0;
    }
   
    while (head != NULL)
    {
        file_upload_time = get_file_create_time(head->filename);
        if (file_upload_time == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        dest = allocate_two_dimension(100, 260);
        if (dest == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }

        int count_path_depth = 0;
#ifdef _WIN32
        split_yr_common(head->filename, '\\', dest, &count_path_depth, strlen(head->filename),100);
#else

        split_yr_common(head->filename, '//', dest, &count_path_depth, strlen(head->filename), 100);
#endif
        file_path_pre = (char *)allocate_one_dimension(260);
        if (file_path_pre == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
       
        if (count_path_depth < 1)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        sub_string(head->filename, 0, strlen(head->filename) - strlen(dest[count_path_depth - 1]), file_path_pre);
        char *file_name_from_split = dest[count_path_depth - 1];
        buf=(char *)allocate_one_dimension(409600);
        if (buf == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
       to_ = (char *)allocate_one_dimension(100);
        if (to_ == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        to_1 = (char *)allocate_one_dimension(100);
        if (to_1 == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }

        to_2 = (char *)allocate_one_dimension(100);
        if (to_2 == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        to_3= (char *)allocate_one_dimension(100);
        if (to_3 == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        to_4 = (char *)allocate_one_dimension(100);
        if (to_4 == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        char *packet_content = "------WebKitFormBoundaryCzP8OxYaOPN4gFyV\r\nContent-Disposition: form-data; name=\"[-1].files\"; filename=\"1.asp\"\r\nContent-Type: application/octet-stream\r\n\r\nMMM\r\n------WebKitFormBoundaryCzP8OxYaOPN4gFyV\r\nContent-Disposition: form-data; name=\"[-1].uploadFilePath\"\r\n\r\nxmas_welcome_dd\r\n------WebKitFormBoundaryCzP8OxYaOPN4gFyV\r\nContent-Disposition: form-data; name=\"[-1].uploadFileCreateDate\"\r\n\r\n2017-01-11 11:25:47\r\n";
        char *rep = "YaOPN4gFyV\r\nContent-Disposition: form-data; name=\"[-1]";
        sprintf(to_,"YaOPN4gFyV\r\nContent-Disposition: form-data; name=\"[%d]",count_tmp_file);
        sprintf(to_1, "Content-Type: application/octet-stream\r\n\r\nMMM%d", count_tmp_file);
        sprintf(to_2, "2017-01-11 11:25:47%d", count_tmp_file);
        sprintf(to_3, ".files\"; filename=\"1.asp%d", count_tmp_file);
        sprintf(to_4, "xmas_welcome_dd%d", count_tmp_file);
        strcpy(buf, packet_content);
        normal_replace(buf, rep, to_);
        normal_replace(buf, "Content-Type: application/octet-stream\r\n\r\nMMM", to_1);
        normal_replace(buf, "2017-01-11 11:25:47", to_2);
        normal_replace(buf, ".files\"; filename=\"1.asp", to_3);
        normal_replace(buf, "xmas_welcome_dd", to_4);
        char *search_content_replace = to_1;
        char *search_file_create_time = to_2;
        char *search_file_name = to_3;
        char *search_file_path = to_4;
        chang_file_time = str_replace(buf, search_file_create_time, file_upload_time);
        if (chang_file_time == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        change_file_path_ = str_replace(chang_file_time, search_file_path, file_path_pre);
        if (change_file_path_ == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        tmp_filename_= (char *)allocate_one_dimension(strlen(".files\"; filename=\"") + strlen(file_name_from_split) + 1);
        if (tmp_filename_ == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        memset(tmp_filename_, 0, strlen(".files\"; filename=\"") + strlen(file_name_from_split) + 1);
        strcat(tmp_filename_, ".files\"; filename=\"");
        strcat(tmp_filename_, file_name_from_split);
        chang_file_name = str_replace(change_file_path_, search_file_name, tmp_filename_);
        if (chang_file_name == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        int tmp_content_length = head->filesize + strlen("Content-Type: application/octet-stream\r\n\r\n") + 1;
        tmp_content = (char *)allocate_one_dimension(tmp_content_length);
        if (tmp_content == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        memset(tmp_content, 0, tmp_content_length);
        strcat(tmp_content, "Content-Type: application/octet-stream\r\n\r\n");
        strncat(tmp_content, head->filebuf,head->filesize);
        send_content = str_replace_bin(chang_file_name, search_content_replace, tmp_content, tmp_content_length);
        if (send_content == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
        send_length_tmp = send_length_tmp + strlen(send_content);
        if (send_length_tmp >= 409600)
        {
            packet_content_tmp = (char *)yr_realloc((packet_content_tmp), (send_length_tmp + 1)* sizeof(char));
            if (packet_content_tmp == NULL)
            {
                free_memory_sock_when_alloc_fail();
                return 0;
            }
        }
        strcat(packet_content_tmp, send_content);
        head = head->next;
        count_tmp_file++;
        free_memory_sock();
    }
    int total_length = send_length_tmp + 46;
    sprintf(send_len, "%d", total_length);
    packet_head_ = str_replace(packet_head, search_content_length_replace, send_len);
    if (packet_head_ == NULL)
    {
        free_memory_sock_when_alloc_fail();
        return 0;
    }
    char *packet_tail = "------WebKitFormBoundaryCzP8OxYaOPN4gFyV--\r\n\r\n";
    if (total_length >= 409600)
    {
        packet = (char *)yr_realloc((packet), (total_length + 1000)* sizeof(char));
        if (packet == NULL)
        {
            free_memory_sock_when_alloc_fail();
            return 0;
        }
    }
    strcat(packet, packet_head_);
    strcat(packet, packet_content_tmp);
    strcat(packet, packet_tail);
    int sock_send_return_code=send(sock, packet, strlen(packet), 0); 
    if (sock_send_return_code == -1)
    {
        free_memory_sock_when_alloc_fail();
        return 0;
    }
    yr_free(packet);
    yr_free(packet_content_tmp);
    yr_free(send_len);
    yr_free(packet_head_);
#ifdef _WIN32
    Sleep(1000);
#else
    sleep(1);
#endif
    char *recvbuf = (char *)allocate_one_dimension(2048);
    if (recvbuf == NULL)
    {
        return 0;
    }
    int a = recv(sock, recvbuf, 2048, 0);
    if (a == 0)
    {
        yr_free(recvbuf);
        return -1;
    }
       
    else if (a == -1)
    {
        printf("recv failed/n");
        yr_free(recvbuf);
        return -1;
    }
    else{
        int recv_len = strlen(recvbuf);
        recvbuf[recv_len] = '\0';
        char *url_start = strstr(recvbuf, "ResultUrl");
        if (url_start == NULL)
        {
            yr_free(recvbuf);
            return 0;
        }
        char *dst = (char *)allocate_one_dimension(512);
        if (dst == NULL)
        {
            yr_free(recvbuf);
            return 0;
        }
        sub_string(url_start, 12, strlen(url_start) - 14, dst);
        if (dst!=NULL)
        {
            printf("\r\n");
            printf("%s\n", dst);
            file*after_sock_ = after_sock;
            file *after_sock_tmp = after_sock;
            while (after_sock != NULL)
            {
                char *md5_tmp = (char *)allocate_one_dimension(33);
                if (md5_tmp == NULL)
                {
                    while (after_sock_tmp->md5 != NULL)
                    {
                        file*after_sock_tmp_ = after_sock_tmp;
                        after_sock_tmp = after_sock_tmp->next;
                        yr_free(after_sock_tmp_->md5);
                        after_sock_tmp_->md5 = NULL;
                    }
                    yr_free(recvbuf);
                    yr_free(dst);
                    return 0;
                }
                strcpy(md5_tmp, md5(after_sock->filebuf));
                after_sock->md5 = md5_tmp;
                yr_free(after_sock->filebuf);
                after_sock->filebuf = NULL;
                after_sock = after_sock->next;
            }
            return_url_each->file = after_sock_;

            return_url_each->url = dst;
            return_url_each->add_time = time(NULL);
            if (r_head == NULL)
            {
                r_head = return_url_each;
            }
            else
            {
                p2->next = return_url_each;
            }
            p2 = return_url_each;  
        }
        else
        {
            return 1;
        }
    }
  
#ifdef _WIN32
    closesocket(sock);
#else
    close(sock);
#endif
    yr_free(recvbuf);
    return 0;
}

return_url *get_r_head()
{
    return r_head;
}

char *compare_hash(char *hash, return_url *head,char *result)
{
    
    file *file = head->file;
    return_url *head_tmp = head;
    while (head_tmp->file != NULL)
    {
        char *md5_string = head_tmp->file->md5;
        if (strcmp(hash,md5_string)==0)
        {
            char *out = (char *)yr_calloc(400, sizeof(char));
            if (out == NULL)
            {
                return NULL;
            }
            strcat(out, head_tmp->file->filename);
            strcat(out,"\t\t");
            if (head_tmp->file->identifier != NULL)
            {
                strcat(out, head_tmp->file->identifier);
            }
            else
            {
                strcat(out, "null");
            }
            strcat(out, "\t\t");
            strcat(out, result);
            strcat(out, "\r\n");
            head->file = file;
            return out;
            break;
        }
        head_tmp->file = head_tmp->file->next;
    }
    head->file = file;
    return NULL;
}

return_url * delete_return_url_list(return_url * head)
{
    return_url * p;
    p = r_head;
    r_head = r_head->next;
    if (r_head == NULL)
    {
        r_head =NULL;  
    }
    p->add_time = NULL;
    while (p->file != NULL)
    {
        file *temp = p->file;
        p->file = p->file->next;
        yr_free(temp->filename);
        temp->filename = NULL;
        yr_free(temp->identifier);
        temp->identifier = NULL;
        yr_free(temp->md5);
        temp->md5 = NULL;
        temp->filesize = NULL;
        temp->used = NULL;
        yr_free(temp);
        temp = NULL;
    }
    p->next = NULL;
    yr_free(p->url);
    p->url = NULL;
    yr_free(p);
    p = NULL;
    return r_head;
}

return_url * delete_return_url_list_p(return_url * r_head_tmp,int i)
{
    if (r_head_tmp->next == NULL || i == 0)
    {
        r_head = delete_return_url_list(r_head_tmp);
        return r_head;
    }
    else
    {
        return_url *p = r_head;
        int j = 0;
        while (p&&j < i - 1)
        {
            p = p->next; ++j;
        }
        return_url *node1 = p;
        return_url *node2 = node1->next;
        if (node2->next == NULL)
        {
           node1->next = NULL;
           p2 = node1;
        }
        node1->next = node2->next;
        node2->add_time = NULL;
        while (node2->file != NULL)
        {
            file *temp = node2->file;
            node2->file = node2->file->next;
            yr_free(temp->filename);
            temp->filename = NULL;
            yr_free(temp->identifier);
            temp->identifier = NULL;
            yr_free(temp->md5);
            temp->md5 = NULL;
            temp->filesize = NULL;
            temp->used = NULL;
            yr_free(temp);
            temp = NULL;
        }
        node2->next = NULL;
        yr_free(node2->url);
        node2->url = NULL;
        yr_free(node2);
        node2 = NULL;
        return node1;
    } 
}

file * delete_web_shell_file_from_all_file_list(file * file_head, int i)
{
    file *node1 = file_head;
    if (file_head == NULL)
    {
        return NULL;
    }
    else if (i == 0)
    {
        file *temp = file_head;
        file_head = file_head->next;
        yr_free(temp->filename);
        temp->filename = NULL;
        yr_free(temp);
        temp = NULL;
        return file_head;
    }
    else
    {
        int j = 0;
        while (node1&&j < i - 1)
        {
            node1 = node1->next;
            ++j;
        }
        file *node2 = node1->next;
        node1->next = node2->next;
         yr_free(node2->filename);
        node2->filename = NULL;
        yr_free(node2);
        node2 = NULL;
        return file_head;
    }
}


file * delete_all_file_list(file * a_head, int i)
{
    file *node1 = a_head;
    if (a_head == NULL)
    {
        return NULL;
    }
    else if (i==0)
    {
        file *temp = a_head;
        a_head = a_head->next;
        return a_head;
    }
    else
    {
        int j = 0;
        while (node1&&j < i - 1)
        {
            node1 = node1->next;
            ++j;
        }
        file *node2 = node1->next;
        node1->next = node2->next;
        return a_head;
    }
}
char *webshell_buf_ = NULL;

void set_webshell_buf(char *buf)
{
    webshell_buf_ = buf;
}


int  send_to_server_report(return_url *r_head, char *write_to_file_buf)
{
    result_list *p2 = NULL;
    result_list *r_head_tmp = NULL;
    time_t start_time = time(NULL);
    char *task_hash_url = r_head->url;
    if (task_hash_url == NULL)
    {
        return 0;
    }
    char *task_hash_tmp = strstr(task_hash_url, "taskhash=");
    if (task_hash_tmp == NULL)
    {
        return 0;
    }
    char *task_hash = (char *)allocate_one_dimension(40);
    if (task_hash == NULL)
    {
        return 0;
    }
    sub_string(task_hash_tmp, 9, 32, task_hash);
    if (task_hash == NULL)
    {
        return 0;
    }
#ifdef _WIN32
    SOCKET sock;
    socket_def(&sock, host, port);
#else
    int sock;
    socket_def(&sock, host, port);
#endif
    char *recv_buf = (char *)allocate_one_dimension(2048);
    if (recv_buf == NULL)
    {
        yr_free(task_hash);
        return 0;
    }
    char *send_buf_tmp = "GET /ShellDaddy/api/result?taskhash=d67d8ab4f4c10bf22aa353e27879133c HTTP/1.1\r\nHost: 182.254.243.223:80\r\nCache-Control: max-age=0\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate, sdch\r\nAccept-Language: zh-CN,zh;q=0.8\r\nConnection: close\r\n\r\n\r\n";
    char *send_buf = str_replace(send_buf_tmp, "d67d8ab4f4c10bf22aa353e27879133c", task_hash);
    if (send_buf == NULL)
    {
        yr_free(task_hash);
        yr_free(recv_buf);
        return 0;
    }
    send(sock, send_buf, strlen(send_buf), 0);
    recv(sock, recv_buf, 2048, 0);
    if (strcmp(recv_buf, ""))
    {
        char *url_start = strstr(recv_buf, "\r\n\r\n");

        char *dst = (char *)allocate_one_dimension(1024);
        if (dst == NULL)
        {
            yr_free(task_hash);
            yr_free(send_buf);
            yr_free(recv_buf);
            return 0;
        }
        sub_string(url_start, 4, strlen(url_start) - 4, dst);
        if (dst == NULL)
        {
            yr_free(task_hash);
            yr_free(recv_buf);
            yr_free(send_buf);
            return 0;
        }
        json_t* json;
        json_t *start_flag, *array_flag;
        json_error_t json_error;
        json = json_loadb(
            (const char*)dst,
            strlen(dst),
            0,
            &json_error);

        start_flag = json_object_get(json, "Result");
        if (start_flag->type == JSON_TRUE)
        {
            array_flag = json_object_get(json, "UploadFileScanReusltList");
            for (int i = 0; i < json_array_size(array_flag); i++)
            {
                result_list* p1 = (result_list*)yr_calloc(1, sizeof(result_list));
                p1->next = NULL;
                json_t *data;
                void *iter_tmp;
                data = json_array_get(array_flag, i);
                iter_tmp = json_object_iter(data);
                char *hash;
                char *result;
                while (iter_tmp)
                {
                    const char *a = json_string_value(json_object_iter_value(iter_tmp));
                    iter_tmp = json_object_iter_next(data, iter_tmp);
                    if (strlen(a) == 32)
                    {
                        hash = (char*)a;
                    }
                    if (strcmp(a, "True") == 0 || strcmp(a, "False") == 0 || strcmp(a, "Scanning") == 0 || strcmp(a, "Suspicious") == 0 || strcmp(a, "UnKnown") == 0)
                    {
                        result = (char*)a;
                        p1->result = (char*)a;
                    }

                }
              
                if (result == NULL || hash==NULL)
                {
                    yr_free(p1);
                    yr_free(task_hash);
                    yr_free(recv_buf);
                    yr_free(send_buf);
                    yr_free(dst);
                    while (r_head_tmp != NULL)
                    {
                        result_list  *r_head_tmp_delete_ = r_head_tmp;
                        yr_free(r_head_tmp_delete_);
                        r_head_tmp_delete_ = NULL;
                        r_head_tmp = r_head_tmp->next;
                    }
                    return 0;
                }
                if (strcmp(result, "True") == 0 || strcmp(result, "False") == 0 || strcmp(result, "Suspicious")==0)
                {
                    char *out_format = compare_hash(hash, r_head, result);
                    if (out_format != NULL)
                    {
                        char *check_exist = strstr(write_to_file_buf, out_format);
                        if (check_exist == NULL)
                        {
                            printf("%s", out_format);
                            int a = strlen(write_to_file_buf) + strlen(out_format);
                            if (a > 10485760)
                            {
                                write_to_file_buf = (char*)realloc(write_to_file_buf, a + 1);
                                if (write_to_file_buf == NULL)
                                {
                                    yr_free(p1);
                                    yr_free(task_hash);
                                    yr_free(send_buf);
                                    yr_free(recv_buf);
                                    yr_free(dst);
                                    while (r_head_tmp != NULL)
                                    {
                                        result_list  *r_head_tmp_delete_ = r_head_tmp;
                                        yr_free(r_head_tmp_delete_);
                                        r_head_tmp_delete_ = NULL;
                                        r_head_tmp = r_head_tmp->next;
                                    }
                                    exit(1);
                                }
                            }
                            strcat(write_to_file_buf, out_format);
                        }
                        yr_free(out_format);
                    } 
                }
                if (!json_is_object(data))
                {
                    fprintf(stderr, "error: commit data %d is not an object\n", i + 1);
                    json_decref(array_flag);
                }

                if (r_head_tmp== NULL)
                {
                    r_head_tmp = p1;
                }
                else
                {
                    p2->next = p1;
                }
                p2 = p1;
               
            }
            while (r_head_tmp != NULL)
            {
                result_list *r_head_tmp_delete = r_head_tmp;
                if (strcmp(r_head_tmp->result, "Scanning") == 0)
                {
                    while (r_head_tmp_delete != NULL)
                    {
                        result_list  *r_head_tmp_delete_ = r_head_tmp_delete;
                        r_head_tmp_delete = r_head_tmp_delete->next;
                        yr_free(r_head_tmp_delete_);
                        r_head_tmp_delete_ = NULL;
                       
                    }
                    return 0;
                }
                r_head_tmp = r_head_tmp->next;
                yr_free(r_head_tmp_delete);
                r_head_tmp_delete = NULL;

            }
            return 1;
        }
        else
        {
            yr_free(task_hash);
            yr_free(recv_buf);
            yr_free(send_buf);
            yr_free(dst);
            return 0;
        }
    }
    else
    {
        yr_free(task_hash);
        yr_free(send_buf);
        yr_free(recv_buf);
        return 0;
    }
    return  0; 
}


char *  get_webshell_buf()
{
    return webshell_buf_;
}

result_list * delete_result_list(result_list * r_l_head)
{
    result_list  * p;
    p = r_l_head;
    r_l_head = r_l_head->next;
    if (r_l_head == NULL)
    {
        r_l_head = (result_list*)yr_calloc(1,sizeof(result_list));
        r_l_head->result = NULL;
    }
    while (p != NULL)
    {
        yr_free(p->result);
        p = p->next;
    }
    return r_l_head;
}

//find address of the rule offset of code_start

unsigned char * get_offset_from_code_start(unsigned long long a, unsigned char  * ip)
{
    char *tmp = (char *)yr_malloc(sizeof(char)*10);
    if (tmp == NULL)
    {
        return NULL;
    }  
    sprintf(tmp, "%x", a);
    char *s0 = (char *)yr_malloc(sizeof(char)* 10);
    if (s0 == NULL)
    {
        yr_free(tmp);
        return NULL;
    }
    char *s1 = (char *)yr_malloc(sizeof(char)* 10);
    if (s1 == NULL)
    {
        yr_free(tmp);
        yr_free(s0);
        return NULL;
    }
    char *s2 = (char *)yr_malloc(sizeof(char)* 10);
    if (s2 == NULL)
    {
        yr_free(tmp);
        yr_free(s0);
        yr_free(s1);
        return NULL;
    }
    char *s3 = (char *)yr_malloc(sizeof(char)* 10);

    if (s3 == NULL)
    {
        yr_free(tmp);
        yr_free(s0);
        yr_free(s1);
        yr_free(s2);
        return NULL;
    }
    sub_string(tmp, strlen(tmp) - 6, strlen(tmp), s0);
    sub_string(s0, 0, 2, s1);
    sub_string(s0, 2, 2, s2);
    sub_string(s0, 4, 2, s3);
    int d1 = strtol(s1, NULL, 16);
    int d2 = strtol(s2, NULL, 16);
    int d3 = strtol(s3, NULL, 16);
    while (1)
    {
        if (*ip == d1 && *(ip - 1) == d2 && *(ip - 2) == d3)
        {
            break;
        }
        ip++;
    }
    while (1)
    {
        if (*ip == 27 && *(ip - 1) == 0 && *(ip - 2) == 0)
        {
            break;
        }
        ip--;
    }
    yr_free(tmp);
    yr_free(s0);
    yr_free(s1);
    yr_free(s2);
    yr_free(s3);
    return ip;
}

unsigned char * get_offset_from_code_start_ip(unsigned char  * ip,int *count)
{
    while (1)
    {
        if (*ip == 27 && *(ip - 1) == 0 && *(ip - 2) == 0)
        {
            break;
        }
        ip++;
        (*count)++;
    }
    return ip;
}
unsigned char * get_offset_whitelist(unsigned char  * ip)
{
    int count = 0;
    while (1)
    {
        if (*ip == 27 && *(ip - 1) == 0 && *(ip - 2) == 0)
        {
            count++;
            if (count == 6)
            {
                break;
            }
        }
        ip++;
     
    }
    return ip;
}
int mode = 0;

int ss_mode = 0;

void set_mode(int a)
{
    mode = a;
}

int  get_mode()
{
    return mode;
}

void set_tlsh_mode(int a)
{
    ss_mode = a;
}

int  get_tlsh_mode()
{
    return ss_mode;
}

int over = 0;

void set_over(int a)
{
    over = a;
}

int  get_over()
{
    return over;
}
int all_file_over = 0;

void set_all_file_over(int a)
{
    all_file_over = a;
}

int  get_all_file_over()
{
    return all_file_over;
}

file *f = NULL;

void set_file(file * a)
{
    f = a;
}

file * get_file()
{
    return f;
}

all_web_shell_file *web = NULL;

void set_web_shell_file(all_web_shell_file * a)
{
    web = a;
}

all_web_shell_file * get_web_shell_file()
{
    return web;
}

int brute_mode_s = 0;

void set_brute_mode(int a)
{
    brute_mode_s = a;
}

int  get_brute_mode()
{
    return brute_mode_s;
}


char *write_buf = NULL;

void set_write_buf(char* a)
{
    write_buf = a;
}


char *  get_write_buf()
{
    return write_buf;
}

int show_strings_ = 0;

void set_show_strings(int a)
{
    show_strings_ = a;
}

int get_show_strings()
{
    return show_strings_;
}
uint8_t *_ip_code = NULL;

void set_code_start(unsigned char *a)
{
    _ip_code = a;
}
unsigned char* get_code_start()
{
    return _ip_code;
}


int algorithm = 0;

void set_algorithm(int a)
{
    algorithm = a;
}

int get_algorithm()
{
    return algorithm;
}

uLong compressBound(uLong sourceLen)
{

    return sourceLen + (sourceLen >> 12) + (sourceLen >> 14) +
        (sourceLen >> 25) + 13;
}

int  compress2(Bytef *dest,
    uLongf *destLen,
    const Bytef *source,
    uLong sourceLen,int level)
{
    z_stream stream;
    int err;
    const uInt max = (uInt)-1;
    uLong left;

    left = *destLen;
    *destLen = 0;

    stream.zalloc = (alloc_func)0;
    stream.zfree = (free_func)0;
    stream.opaque = (voidpf)0;

    err = deflateInit(&stream, level);
    if (err != 0) return err;

    stream.next_out = dest;
    stream.avail_out = 0;
    stream.next_in = (Bytef *)source;
    stream.avail_in = 0;

    do {
        if (stream.avail_out == 0) {
            stream.avail_out = left > (uLong)max ? max : (uInt)left;
            left -= stream.avail_out;
        }
        if (stream.avail_in == 0) {
            stream.avail_in = sourceLen > (uLong)max ? max : (uInt)sourceLen;
            sourceLen -= stream.avail_in;
        }
        err = deflate(&stream, sourceLen ? 0 : 4);
    } while (err == 0);

    *destLen = stream.total_out;
    deflateEnd(&stream);
    return err == 1 ? 0 : err;
}

int  compress(Bytef *dest,
    uLongf *destLen,
    const Bytef *source,
    uLong sourceLen)
{

    return compress2(dest, destLen, source, sourceLen, Z_DEFAULT_COMPRESSION);
}

char **algorithm_flag;

void set_algorithm_buf(char **a)
{
    algorithm_flag = a;
}

char **get_algorithm_buf()
{
    return algorithm_flag;
}

float *array_webshell_flat;

void set_array_webshell(float *a)
{
    array_webshell_flat = a;
}

float*get_array_webshell()
{
    return array_webshell_flat;
}


float *array_not_webshell_flat;

void set_array_not_webshell(float *a)
{
    array_not_webshell_flat = a;
}

float*get_array_not_webshell()
{
    return array_not_webshell_flat;
}


int check_file_type(unsigned char *a,char *suffix,int size)
{
    if (size > 4)
    {
        if ((a[0] == 0x00&&a[1] == 0x01&&strcmp(suffix, "dll") == 0)
            || (a[0] == 0x53&&a[1] == 0x65&&strcmp(suffix, "vbs") == 0)
            || (a[0] == 0x73&&a[1] == 0x74&&strcmp(suffix, "bat") == 0)
            || (a[0] == 0x4d&&a[1] == 0x52&&strcmp(suffix, "exe") == 0)
            || (a[0] == 0xef&&a[1] == 0xbb&&strcmp(suffix, "js") == 0)
            || (a[0] == 0xef&&a[1] == 0xbb&&strcmp(suffix, "txt") == 0)
            || (a[0] == 0xef&&a[1] == 0xbb&&strcmp(suffix, "css") == 0)
            || (a[0] == 0x3c&&a[1] == 0x21&&strcmp(suffix, "html") == 0)
            || (a[0] == 0x75&&a[1] == 0x73&&strcmp(suffix, "aspx.cs") == 0)
            || (a[0] == 0x89&&a[1] == 0x50&&strcmp(suffix, "png") == 0)
            || (a[0] == 0xff&&a[1] == 0xd8&&strcmp(suffix, "jpeg") == 0)
            || (a[0] == 0x00&&a[1] == 0x48&&strcmp(suffix, "jpg") == 0)
            || (a[0] == 0xff&&a[1] == 0xd8&&strcmp(suffix, "jpg") == 0)
            || (a[0] == 0x47&&a[1] == 0x49&&strcmp(suffix, "gif") == 0)
            || (a[0] == 0x7b&&a[1] == 0x0a&&strcmp(suffix, "json") == 0)
            || (a[0] ==0x5b&&a[1] == 0x0a&&strcmp(suffix, "json") == 0)
            || (a[0] == 0x3c&&a[1] == 0x3f&&a[2] == 0x78&&strcmp(suffix, "xml") == 0)
            || (a[0] == 0x42&&a[1] == 0x4d&&strcmp(suffix, "bmp") == 0)
            || (a[0] == 0x41&&a[1] == 0x43&&strcmp(suffix, "dwg") == 0)
            || (a[0] == 0x50&&a[1] == 0x4b&&a[2] == 0x03&&a[3] == 0x04&&strcmp(suffix, "zip") == 0)
            || (a[0] == 0x50&&a[1] == 0x4b&&a[2] == 0x03&&a[3] == 0x04&&strcmp(suffix, "docx") == 0)
            || (a[0] == 0x52&&a[1] == 0x61&&a[2] == 0x72&&a[3] == 0x21&&strcmp(suffix, "rar") == 0)
            || (a[0] == 0x57&&a[1] == 0x41&&a[2] == 0x56&&a[3] == 0x45&&strcmp(suffix, "wav") == 0)
            || (a[0] == 0x41&&a[1] == 0x56&&a[2] == 0x49&&a[3] == 0x20&&strcmp(suffix, "avi") == 0)
            || (a[0] == 0x2e&&a[1] ==0x52&&a[2] == 0x4d&&a[3] == 0x46&&strcmp(suffix, "rm") == 0)
            || (a[0] == 0x25&&a[1] == 0x50&&a[2] == 0x44&&a[3] == 0x46&&strcmp(suffix, "pdf") == 0)
            || (a[0] == 0xd0&&a[1] == 0xcf&&a[2] == 0x11&&a[3] == 0xe0&&strcmp(suffix, "xls") == 0)
            || (a[0] == 0xd0&&a[1] == 0xcf&&a[2] == 0x11&&a[3] == 0xe0&&strcmp(suffix, "doc") == 0)
            || (a[0] == 0x00 && a[1] == 0x00 && a[2] == 0x01 && a[3] == 0x00 && strcmp(suffix, "ico") == 0)
            ||  strcmp(suffix, "sql") == 0
            || strcmp(suffix, "dat") == 0
            || strcmp(suffix, "mp3") == 0 
            || strcmp(suffix, "md5") == 0 
            || strcmp(suffix, "ttf") == 0
            || strcmp(suffix, "table") == 0
            
            )
        {
            return 1;
        }
        else
        {
            return 0;
        }
    }
    else
    {
        return 1;
    }
}


int check_file_type_algorithm(char *a)
{
    if ( strcmp(a, "asp") == 0
        || strcmp(a, "jsp") == 0 
        || strcmp(a, "php") == 0 
        || strcmp(a, "war") == 0 
        || strcmp(a, "aspx") == 0
        || strcmp(a, "jspx") == 0
        || strcmp(a, "pl") == 0
        || strcmp(a, "py") == 0
        )
    {
        return 1;
    }
    else
    {
        return 0;
    }
}

char *ends_with(char *a)
{
    int length = strlen(a);
    char *tmp = a+length;
    int positon = 0;
    while (*tmp != '.')
    {
        positon++;
        tmp--;
    }
    return tmp+1;
}